Observations lead to discoveries,

Observations

Last year I made a switch to another mail provider. In order to get the mail in the right inbox I had to change my email address for many accounts. Administration is not one of my favourite things.

To make a start, I chose the most frequently used accounts. I logged in for one account. Using my email address and password. The obvious way to update my email address was to go to the Settings or Account section of my account.

I found my old email address waiting for an update. So, what was I waiting for? I changed the email address and got a message, that a verification mail was sent to my new email address. I already checked the entered email address twice. What was the need for verification?

Time to watch the inbox of my new email account. And yes, there was an email with a link to verify that the email address actually existed. That sounded logical to me. I clicked the link and then things changed.

In my inbox of my old mail account, I got a message, that my email address was changed. That was quite polite.

As a tester I found a security hole. Again.

Discoveries

Naming the terms

If someone else would post something bad on my social media account, them this could lead to reputation damage. If someone else orders something on my shopping account, then I would lose money.

In the case someone else has the user id and the password to an account of me, then account takeover has taken place. That is something I would like to avoid.

In the world of technology it takes a lot of time and energy to make a product or app, which is better than the competing products or apps. In certain cases, it is possible to look at parts of an existing product and figuring out, how it works.

A program is a system, which contains instructions for the computer to do certain tasks. Why should I not use reverse engineering for a cyber security attack. It is just a list of steps.

Using my observations, I could make a test idea for an account takeover.

Naming the condition’s

As a tester I have to look at security. If I use my observations, how would I do an account takeover. In other words, how do I reverse engineer an account takeover?

Sketching a test idea

Here is a rough description to take over an account.

If a laptop is not locked and an account has been opened, then change the email address in the Settings or Personal information section.

Open the verification mail in the mailbox of the new mail address and folow the instructions.

If the mail with mail address change is sent to the inbox of the old email adress , remove it in the inbox. Then remove the mail in the Trash.

Later, go to the Login Page, press on the link ‘Password forgotten’, and follow the instructions.

The account has a new user id and new password. The account has been taken over.

Recommendations for the user

Log out or lock the laptop, if you leave it alone.

Check your accounts regularly.

Open only accounts, if needed.

Use two factor authentication.

Looking forward

In the next blog post I will describe a situation with high level of security and appropriate measures.

To be continued.